PU020393 (JP6348616) ON 8796 

(19) Patent Agency of Japan (JP) 

(12) Official report on patent publication (A) 

(1 1) Publication number: 6-348616 

(43) Date of publication of application: 22.12.1994 

(51) Int.Cl. G06F 13/00 H04L 12/24 H04L 12/26 

(21) Application number: 5-165224 

(22) Date of filing: 10.06.1993 

(71) Applicant: NEC Corp 

(72) Inventor: Muto Katsue 

(54) Title of the invention: Event report processing circuit 
(57) Abstract: 

Purpose: To increase the event report processing speed. 
Constitution: An extracting means 1 extracts a controlled 
system in response to the attribute of the received event 
report out of a list of controlled systems that are registered 
for each attribute. A deciding means 2 decides whether 
the received event report satisfies or not the information 
conditions of the controlled system that is extracted by the 
means 1 . If the informing conditions are satisfied, an 
informing means 3 informs the informing destination of 
the controlled system of the even report. 

[Claim] 

[Claim 1] An event report processing circuit including a 
storing means which stores a notification condition to a 
report destination which should notify an inputted event 
report and the mentioned above report destination of the 
mentioned above event report for every attribute of the 
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mentioned above event report, an extracting means to 
extract the mentioned above notification condition 
corresponding to an attribute and the mentioned above 
report destination of the event report concerned from the 
mentioned above storing means at the time of an input of 
the mentioned above event report, a deciding means 
which decides whether the event report concerned fulfills 
a notification condition extracted by the mentioned above 
extracting means, a means to notify to a report destination 
corresponding to a notification condition from which the 
event report concerned was extracted by the mentioned 
above extracting means when decided with fulfilling a 
notification condition extracted by the mentioned above 
extracting means by the mentioned above deciding means. 

[Detailed description of the invention] 

[0001] [Industrial application] Especially this invention 
relates to event report mode of processing in the network 
management system which is performing event report 
processing by the administration object which owns the 
notification condition and report destination of an event 
report about an event report processing circuit. 
[0002] [Description of the prior art] Conventionally, in 
this kind of event report mode of processing, as shown on 
drawing 3, every administration object (EFD) which 
exists in a system at the time of an event report is taken 
out and it is investigated whether it is in the event report 
which the attribute specified by the notification condition 
received. 
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[0003] That is, in an event report processing circuit, 
reception of an event report will acquire one 
administration object registered preliminary (drawing 3, 
step 21). It is confirmed whether an event report 
processing circuit fulfills the notification condition which 
the administration object which the received event report 
acquired has (drawing 3, step 22). 
[0004] In this check processing, it confirms whether all 
the attributes shown on the notification condition which 
an administration object has first are contained in an event 
report and when contained, comparison processing of 
conditions (Fiher Item), such as the range of the kind of 
attribute and the value of that attribute, is performed ((1) 
of the drawing 3, step 22). 

[0005] Next, when the notification condition is defined by 
the logical formula of the mentioned above conditions, a 
logical operation is performed based on the comparison 
result of a monograph affair ((2) of the drawing 3, step 
22). If the result of an operation is an imitation (drawing 
3, step 23), it will be decided whether the administration 
object which is not checked remains (drawing 3, step 25). 
[0006] If the result of an operation is truth (drawing 3, 
step 23), it will be decided whether the received event 
report was notified to the report destination specified by 
the administration object (drawing 3, step 24) and the 
administration object that is not checked remains 
(drawing 3, step 25). 
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[0007] If the administration object which is not checked 
remains, it returns to Step 21 and the following 
administration object is acquired and the mentioned above 
processing will be repeated and will be performed. 
Processing is ended if the administration object which is 
not checked does not remain. Thus, in the event report 
processing circuit, the mentioned above processing is 
performed to all the administration objects which exist in 
a network management system. 
[0008] [Problems to be solved by the invention] In the 
conventional event report mode of processing mentioned 
above, when combination with conditions, such as the 
range of the kind of an attribute and attribute included in 
the notification condition of one administration object and 
the value of the attribute, exists in other administration 
objects, it will carry out by repeating the same 
comparison processing and there is a problem that event 
report processing takes time. 
[0009] Next, it is in the purpose of this invention 
providing the event report processing circuit which can 
cancel the mentioned above problem and can achieve 
improvement in the speed of event report processing. 
[0010] [Means for solving the problem] An event report 
processing circuit by this invention includes a storing 
means which stores a notification condition to a report 
destination which should notify an inputted event report 
and the mentioned above report destination of the 
mentioned above event report for every attribute of the 
mentioned above event report, an extracting means to 
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extract the mentioned above notification condition 
corresponding to an attribute and the mentioned above 
report destination of the event report concerned from the 
mentioned above storing means at the time of an input of 
the mentioned above event report, a deciding means 
which decides whether the event report concerned fulfills 
a notification condition extracted by the mentioned above 
extracting means, a means to notify to a report destination 
corresponding to a notification condition from which the 
event report concerned was extracted by the mentioned 
above extracting means when decided with fulfilling a 
notification condition extracted by the mentioned above 
extracting means by the mentioned above deciding means. 
[001 1] [Example] Next, one example of this invention is 
described with reference to drawings. 
[0012] Drawing 1 is a drawing showing the composition 
of one example of this invention. In a drawing, the 
extracting means 1 of the event report processing circuit 
by one example of this invention extracts the 
administration object corresponding to the attribute of the 
event report received out of the list of administration 
objects (EFD) registered into the storing means 4 for 
every attribute. 

[0013] It is decided whether the deciding means 2 fulfills 
the notification condition of the administration object 
from which the received event report was extracted by the 
extracting means 1 . The reporting means 3 notifies the 
event report concerned to the report destination of an 
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administration object, when it decides with the deciding 
means 2 fulfilling the notification condition. 
[0014] Drawing 2 is a drawing showing the example of 
composition of the storing means 4 of drawing 1 . In the 
drawing, an attribute name, conditions (it carries out the 
following Filter Item), such as the range of the kind of 
attribute and the value of the attribute and an 
administration object name are matched, respectively and 
are registered into the storing means 4 as an EFD list. 
[0015] Here, efdl in a drawing has the notification 
condition «alarm generation time is 1993/05/25 - 9:00 and 
alarm importance notifies 3 or more alarms». 
[0016] efd2 has the notification condition «the kind of 
alarm is a transmission level fall and generation times 
notifies the alarm 1993/04/25». efd3 has the notification 
condition «the kind of alarm is a power fail and 
generation times notifies the alarm before 1993/05/25, 
12:00». 

[0017] As the thing arranged for every attribute name 
«alarm generation time», «the kind of alarm» and «the 
importance of alarm» drawing 2shows these 
administration objects efd 1-3, it will be registered with 
the storing means 4. 

[0018] Operation of one example of this invention is 
explained using these drawing 1 and drawing 2. In the 
network management system with which the 
administration objects efdl-efd3 as shown on drawing 2 
at the storing means 4 are registered next, event report 
processing when the event report with an attribute name 
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«alarm generation time» and «the kind of alarm» occurs is 
explained. 

[0019] When the mentioned above event report is 
received, the extracting means 1 confirms whether the 
attribute name «alarm generation time» and «the kind of 
alarm» which are included in an event report exist in the 
EFD list of storing means 4 (drawing 1, step 11). 
[0020] The extracting means 1 compares Filter Item 
altogether about the attribute decided that exists in an 
EFD list as a result of a check (drawing 1, step 12). That 
is, since the condition of the extracting means 1 is «<= 
(next)» and «>= (before)» in Filter Item of an attribute 
name «alarm generation time», comparison before alarm 
generation time is performed alarm generation time or 
below. 

[0021] Since the condition of the extracting means 1 is «= 
(equal))) in Filter Item of an attribute name «kind of 
alarm)), it is compared whether the kind of alarm is equal. 
[0022] Next, the extracting means 1 probes the 
administration object of the notification condition 
including all the attributes of an event report (drawing 1, 
step 13). In this case, the extracting means 1 probes efd2 
and efd3 as an administration object of the notification 
condition including all of the attribute name «alarm 
generation time)) and «the kind of alarm)) which an event 
report has. 

[0023] The extracting means 1 acquires one of 
administration object efd2 and efd3 probed and passes it 
to the deciding means 2 (drawing 1, step 14). 
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At this time, the extracting means 1 shall be passed to the 
deciding means 2 in order of administration object efd2 
and administration object efd3. 
[0024] The deciding means 2 performs the logical 
operation specified as the notification condition of 
administration object efd2 based on the comparison 
processing result of Filter Item performed by the 
extracting means 1 (drawing 1, step 15) and decides 
whether a logical operation result (decision result of a 
notification condition) is truth (drawing 1, step 16). 
[0025] At this time, the logical operation (in this case and 
operation) of the comparison result of «<= (next)» to 
«alarm generation time» and the comparison result of «= 
(equal)» to «the kind of alarm» is performed by the 
deciding means 2. That is, by the deciding means 2, alarm 
generation time is decided for the kind of alarm 
1993/04/25 whether it is a transmission level fall. 
[0026] Since the deciding means 2 will pass the received 
event report to the reporting means 3 if a logical operation 
result decides with it being truth, the reporting means 3 
transmits the received event report to the report 
destination specified by administration object efd2 
(drawing 1, step 17). 

[0027] If decided with a logical operation result is an 
imitation by the deciding means 2 or if an event report is 
transmitted to a report destination by the reporting means 
3, it will be decided whether the administration object 
probed by the extracting means 1 remains (drawing 1 step 
18). 
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[0028] If it remains and the administration object which 
remains in the deciding means 2 is passed and it does not 
remain from the extracting means 1, event report 
processing is completed. In this case, supposing 
administration object efd3 remains, administration object 
efd3 will be passed to the deciding means 2 from the 
extracting means 1 . 

[0029] Based on the comparison processing result of 
Filter Item performed by the extracting means 1, the 
deciding means 2 like processing of above administration 
object efd2, the logical operation specified as the 
notification condition of administration object efd3 is 
performed (drawing 1 , step 1 5) and it is decided whether 
a logical operation result (decision result of a notification 
condition) is truth (drawing 1, step 16). 
[0030] At this time, the logical operation (in this case and 
operation) of the comparison result of «>= (before)» to 
«alarm generation time» and the comparison result of «= 
(equal))) to «the kind of alarm)) is performed by the 
deciding means 2. That is, by the deciding means 2, alarm 
generation time is decided for the kind of alarm before 
1993/05/25 and 12:00 whether it is a power fail. 
[0031] Since the deciding means 2 will pass the received 
event report to the reporting means 3 if a logical operation 
result decides with it is truth, the reporting means 3 
transmits the received event report to the report 
destination specified by administration object efd3 
(drawing 1, step 17). 
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[0032] If decided with a logical operation result is an 
imitation by the deciding means 2 or if an event report is 
transmitted to a report destination by the reporting means 
3, it will be decided whether the administration object 
probed by the extracting means 1 remains (drawing 1, 
step 18). 

[0033] If it remains and the administration object which 
remains in the deciding means 2 is passed and it does not 
remain from the extracting means 1, event report 
processing is completed. In this case, supposing the 
administration object does not remain, event report 
processing will be ended. 

[0034] As mentioned above, in the one example of this 
invention, Filter Item is altogether compared about the 
attribute decided that exists in an EFD list based on the 
attribute name «alarm generation time» and «the kind of 
alarm» which are included in the received event report. 
[0035] Thus, the comparison processing of Filter Item can 
be managed with 3 comparison processings of the 
comparison processing to «<= (next)» and «>= (before)» 
which are the conditions of an attribute name «alarm 
generation time» and the comparison processing to «= 
(equal)» which is the conditions of an attribute name 
«kind of alarm». 

[0036] On the other hand, in the conventional example, it 
is carrying out to all the administration objects in a 
network management system including the attribute name 
«alarm generation time» included in the received event 
report and «the kind of alarm». 



10 



[0037] Thus, the comparison processing to «<= (next)» 
which is the conditions of the attribute name «alarm 
generation time» of administration object efdl, the 
comparison processing to «= (equal)» which is the 
conditions of comparison processing and an attribute 
name «kind of alarm» over «<= (next)» which is the 
conditions of the attribute name «alarm generation time» 
of administration object efd2, 5 comparison processings 
with the comparison processing to «= (equal)» which is 
the conditions of comparison processing and an attribute 
name «kind of alarm» over «>= (before)» which is the 
conditions of the attribute name «alarm generation time» 
of administration object efd3 are needed. 
[0038] Thus, arranging an administration object for every 
attribute and registering with the storing means 4, the 
extracting means 1 extracts the administration object of 
the notification condition including all the attributes 
contained in the received event report, it is decided by the 
deciding means 2 whether the logical operation specified 
as the notification condition of this extracted 
administration object is performed and the notification 
condition concerned is fulfilled, when it decides with 
fulfilling the notification condition, by notifying the event 
report concerned to the report destination of an 
administration object from the reporting means 3, the 
comparison processing of Filter Item in the administration 
object that exists in a network management system can be 
managed with necessary minimum processing. 
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[0039] Thus, after receiving an event report, a notification 
condition can be decided, time until it notifies the event 
report concerned to a report destination can be shortened 
and improvement in the speed of event report processing 
can be achieved. 

[0040] [Effect of the invention] As explained above, 
according to this invention, it stores for every attribute of 
an event report of the notification condition to the report 
destination which should notify the inputted event report 
and the report destination of an event report, the 
notification condition and report destination 
corresponding to an attribute of the event report 
concerned are extracted at the time of the input of an 
event report, when decided with fulfilling the notification 
condition from which the event report concerned was 
extracted, by notifying to the report destination 
corresponding to the notification condition from which 
the event report concerned was extracted, it is effective in 
the ability to achieve improvement in the speed of event 
report processing. 

[Brief description of the drawings] 
[Drawing 1] is a drawing showing the composition of one 
example of this invention. 

[Drawing 2] is a drawing showing the example of 
composition of a storing means of drawing 1 . 
[Drawing 3] is a flow chart showing event report 
processing of a conventional example. 



12 



[Description of numerals] 

1 Extracting means 

2 Deciding means 

3 Reporting means 

4 Storing means 
[Written amendment] 

[Filing date] December 17, 1993 
[Amendment 1] 

[Document to be amended] Specification 
[Item to be amended] Claim 
[Method of amendment] Change 
[Proposed amendment] 

[Claims] 

[Claim 1] An event report processing circuit including a 
storing means which stores a notification condition to a 
report destination which should notify an inputted event 
report and the mentioned above report destination of the 
mentioned above event report for every attribute of the 
mentioned above event report, an extracting means to 
extract the mentioned above notification condition 
corresponding to an attribute and the mentioned above 
report destination of the event report concerned from the 
mentioned above storing means at the time of an input of 
the mentioned above event report, a deciding means 
which decides whether the event report concerned fulfills 
a notification condition extracted by the mentioned above 
extracting means, a means to notify to a report destination 
corresponding to a notification condition from which the 
event report concerned was extracted by the mentioned 



13 



above extracting means when decided with fulfilling a 
notification condition extracted by the mentioned above 
extracting means by the mentioned above deciding means. 

[Claim 2] The event report processing circuit according to 
claim 1 including a means by which the mentioned above 
extracting means probes the attribute of the event report 
concerned which includes all of an attribute name and a 
range of a value of an attribute at least at the time of an 
input of the mentioned above event report, a means to 
extract the mentioned above notification condition 
corresponding to a probed attribute and the mentioned 
above report destination from the mentioned above 
storing means. 



Drawing 2 
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Drawing 1 




Drawing 3 
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